Malicious Code Execution Vulnerability in semvver Package
Summary
MAL-2026-18104: Malicious code in semvver (PyPI). Affects semvver versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The semvver package, available on PyPI, is designed as a utility helper for Python developers. However, it has been identified as containing malicious code that executes during installation. The package's primary functionality is compromised, as it serves as a dropper for executing arbitrary code on the installer's machine, posing significant security risks.
Vulnerability Detail
The vulnerability originates from the setup.py file of the semvver package, which performs an install-time fetch-and-execute operation. It uses urllib.request.urlretrieve to download a binary from an unverified Cloudflare Workers subdomain and executes it as a detached background process. This behavior allows an attacker to gain arbitrary code execution on the installer's host without any verification of the downloaded content. The package lacks any legitimate functionality, making the malicious payload its sole purpose.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall semvverIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid installing the semvver package until a secure version is released. If you have already installed it, you can uninstall it using the command: pip uninstall semvver.
Conclusion
The semvver package has been identified as containing malicious code that poses significant security risks to users. It is essential to uninstall the package and monitor for any updates or patches. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for semvver →
FAQ
semvver is a utility helper package for Python developers, but it has been compromised with malicious code.
The vulnerability allows the package to download and execute malicious code during installation, leading to potential arbitrary code execution on the user's machine.
You should uninstall the semvver package immediately using the command: pip uninstall semvver.
Currently, there is no patched version available. Monitor the package repository for updates.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground without signup.
